rallly
v4.17.0Rallly is an open-source scheduling and collaboration tool designed to make organizing events and meetings easier.
- Maintenance
- ActiveBased on the last push: commit history is not collected yet
- License
- AGPL-3.0Copyleft · OSI-approved
- Security
- 14 advisories2 critical, 12 medium
- Supported versions
- No scheduleendoflife.date does not track this project
5.4k stars · 592 forks · 7 open issues · last release 3 days ago · data checked 1 hour ago
Security advisories
All advisories on GitHubThe 14 most recent advisories published by the maintainers: 2 critical, 12 medium. Check the patched version against the one you run.
- criticalGHSA-gmq4-f8j5-8w8qOct 6, 2026Remote code execution in poll preview images via vulnerable Next.js next/og
- Affected
- >= 4.8.0, < 4.15.4
- Patched in
- 4.15.4
- mediumGHSA-jprp-6gw6-jwcrSep 9, 2026Unauthenticated Access to Deleted Poll Data via Public API
- Affected
- < 4.12.0
- Patched in
- 4.12.0
- mediumGHSA-34w3-569j-j947Aug 3, 2026Rallly: a space administrator can remove or demote the space owner, permanently locking the owner out of their own space
- Affected
- < 4.12.0
- Patched in
- 4.12.0
- mediumCVE-2025-66027Nov 28, 2025Information Disclosure in Participant API Leaks Names and Emails Despite Pro Privacy Settings
- Affected
- < 4.5.6
- Patched in
- >= 4.5.6
- mediumCVE-2025-65031Nov 19, 2025Improper Authorization in Comment Endpoint Allows User Impersonation
- Affected
- < 4.5.4
- Patched in
- >= 4.5.4
- mediumCVE-2025-65030Nov 19, 2025Improper Authorization in Comment Deletion Endpoint Allows Unauthorized Comment Removal
- Affected
- < 4.5.4
- Patched in
- >= 4.5.4
- mediumCVE-2025-65029Nov 19, 2025IDOR in Participant Deletion Endpoint Allows Unauthorized Removal of Poll Participants
- Affected
- < 4.5.4
- Patched in
- >= 4.5.4
- mediumCVE-2025-65028Nov 19, 2025IDOR in Vote Update Endpoint Allows Unauthorized Manipulation of Participant Votes
- Affected
- < 4.5.4
- Patched in
- >= 4.5.4
- mediumCVE-2025-65033Nov 19, 2025Broken Authorization: Any User Can Pause or Resume Any Poll via Poll ID Manipulation
- Affected
- < 4.5.4
- Patched in
- >= 4.5.4
- mediumCVE-2025-65032Nov 19, 2025IDOR in Participant Rename Function Allows Unauthorized Modification of Other Users’ Names
- Affected
- < 4.5.4
- Patched in
- >= 4.5.4
- mediumCVE-2025-65034Nov 19, 2025Improper Authorization Allows Reopening of Any Finalized Poll via Public pollId
- Affected
- < 4.5.4
- Patched in
- >= 4.5.4
- mediumCVE-2025-65021Nov 19, 2025Unauthorized Poll Finalization via Insecure Direct Object Reference (IDOR)
- Affected
- < 4.5.4
- Patched in
- >= 4.5.4
- mediumCVE-2025-65020Nov 19, 2025Unauthorized Poll Duplication via Insecure Direct Object Reference (IDOR)
- Affected
- < 4.5.4
- Patched in
- >= 4.5.4
- criticalCVE-2025-47781May 14, 2025Insufficient Password Login Token Entropy Leads to Account Takeover
- Affected
- <=3.11.2